The First 24 Hours: A Step by Step Plan If You Think You Have Sent Money to a Criminal

You think you have sent money to a criminal. What do you do next?

The short answer: move fast, in this order. Call your bank's fraud line, lock your crypto and investment accounts yourself, stop all payments and contact, secure your email account, revoke any wallet permissions you granted, save every piece of evidence before it disappears, then report to Scamwatch and ReportCyber. Do all of this before you spend energy on trying to get the money back.

That gut drop when you realise something is wrong is horrible, and it makes people freeze or start negotiating with the person who took the money. Neither helps. What helps is a checklist, so here is one.

First 15 minutes: your bank and your platforms

This goes first because it is the only step with a closing window. Bank transfers can sometimes be recalled, traced or held if you raise the alarm quickly enough. An hour of hesitation can be the difference between a recall and a write off.

Call your bank's fraud line directly, using the number on the back of your card. Ask them to:

• attempt a recall or trace on recent transfers, since some payments can still be stopped
• block your cards and place a hold on further outgoing payments
• flag the account for monitoring
• give you a case reference number before you hang up

Then lock down every platform involved. If you hold funds with CoinJar, you do not need to wait for us: lock your own account from inside the app. Go to More > Customer Support > Lock Account, answer the security questions and confirm. The lock is instant, and it disables buying, selling, sending, receiving and withdrawals while leaving you able to log in and see your balance. Full steps are in our guide to locking your CoinJar account. Change your password immediately afterwards, then tell us what happened through the app or our official support page so we can review the account. Do not use a phone number someone sent you, and do not wait for a reply before you start on the steps below.

Unlocking is deliberately not instant, because our team verifies your identity before restoring access. That is the point of the feature, and it is a small price for shutting the door in seconds.

Three rules that apply from this second onward:

• Send nothing further. Not a "test payment", not a fee, not a final transfer to release funds. The request for one more payment is part of the same operation.
• Do not tell them you know. Just stop responding. Advance warning gives them time to move funds and delete the account you need screenshots of.
• Do not delete anything. Chats, emails, SMS, ads, receipts, phone numbers, profile pages. All of it is evidence and some of it will vanish within hours.

While you are on hold: lock things down in the apps

Fraud lines have queues, and that wait is useful time rather than dead time. Put the call on speaker and work through your apps while you wait. If you granted anyone remote access to a device, disconnect that device from the internet first and do all of this from a different one.

In your banking app:

• freeze or lock your cards
• cancel any scheduled or pending payments
• delete saved payees you do not recognise, including any added during the contact
• reduce your daily transfer limit to the minimum the app allows

In every exchange, brokerage or investment app you hold funds with:

• if the account is with CoinJar, use More > Customer Support > Lock Account to freeze it instantly, then change your password
• change the password to something unique on every other platform
• log out all other sessions and remove unrecognised devices
• check whether the email address, phone number or two factor method on the account has been changed
• remove saved withdrawal addresses you did not add yourself
• delete any API keys you are not actively using
• turn off withdrawals entirely if the platform offers that switch

Screenshot each screen as you go. It is faster than trying to describe it later, and it doubles as evidence.

Minutes 15 to 45: secure your email

People rush to their bank and forget that email is the master key. Whoever controls your inbox can reset almost everything else, including the accounts you just locked.

• Change your email password from a clean device, and make it unique.
• Turn on app based two factor authentication rather than SMS where possible, since SMS can be intercepted through phone porting. Our guide to SIM swap attacks explains why this matters.
• Check for mail forwarding rules or filters you did not create. Quietly forwarding your mail to an attacker is a classic move.
• Then work outward: superannuation, and any other account that shared that password.

Minutes 45 to 90: wallet connections and permissions

Sending funds is not the only exposure. If you connected a self custody wallet to a website or approved a transaction you now doubt, that permission can keep draining funds long after the moment has passed.

• Revoke the approvals for that wallet, using the wallet's own settings or a revocation tool you reach through a link from your wallet provider rather than a search result.
• If a recovery phrase or private key was ever typed into a website, shared in a chat, photographed, or stored in cloud notes, treat that wallet as permanently compromised. Create a brand new wallet with a new recovery phrase and move any remaining assets there.
• Never enter a recovery phrase to "validate", "sync" or "recover" a wallet. There is no legitimate reason for a website to ask.

Before the day ends: save the evidence

Screenshot everything, including the parts that feel embarrassing. Capture profile URLs, wallet addresses, transaction IDs, bank reference numbers, phone numbers, ad screenshots and the full chat history. Note dates, amounts and what you were told.

Store it in one folder. You will need it for the bank, for the report, and possibly for a much later law enforcement request, and you will absolutely not want to reconstruct it from memory in three months.

Report it, properly and today

• Your bank or payment provider. Already done above, but confirm you have that case reference in writing.
• Scamwatch, run by the ACCC's National Anti Scam Centre. This is what feeds the national picture and triggers disruption work.
• ReportCyber for cybercrime. This routes to police and gives you a report number.
• IDCARE if identity documents or personal information were exposed. Free support for Australians, and worth using even if no money moved.

Reporting takes about twenty minutes. It is the single most useful thing most people can do, and it is the step most often skipped.

What actually happens when you report

A fair question, because plenty of people assume a report vanishes into a form and nothing follows.

Reports feed the National Anti Scam Centre's disruption work. According to its Targeting Scams report for 2025, the centre referred more than 8,400 websites for assessment, assisted with the removal of more than 7,500 scam URLs, and referred thousands of phone numbers, sender IDs and advertisements for action. It also referred more than 8,500 Scamwatch reporters to IDCARE for recovery support.

Your report might not recover your funds. It genuinely can shorten the life of the website, ad or number that reached you, which is how the next person avoids the same afternoon.

Expect a second approach

Within weeks, someone may contact you offering to recover the money for an upfront fee. They may claim to be a blockchain forensics firm, a law firm, or an official body. Victim lists get resold, and a person who has already lost money is treated as a promising target.

Confirmed blockchain transactions cannot be reversed by a third party. Assume any unsolicited recovery offer is a second attempt, and verify anyone claiming otherwise through a channel you found yourself.

Tell one human being

Shame is the most reliable tool criminals have. Investigators consistently report that a large share of victims never come forward because they feel foolish, which means the official loss totals are a floor rather than a ceiling.

For context, the ACCC's Targeting Scams report for 2025 recorded 481,523 reports and $2.18 billion in reported losses, and Australians aged 65 and over accounted for a disproportionate share of reported losses relative to their share of the population. Every one of those numbers is a person who had a day like the one you are having.

Tell someone you trust today. It steadies you, and it stops the isolation that lets a second approach succeed.

Why we are publishing this during Scams Awareness Week

Scams Awareness Week runs from 24 to 28 August 2026, with the theme "No one's just a number" and three steps to remember: Stop. Check. Protect. CoinJar has supported the campaign for years, and you can read about our ongoing work on scam detection and prevention.

If today is your day for this checklist, work through it in order, then close the laptop and tell someone. You are not a number, and you are not the first person to have a very bad day.